Action - AWS Security Hub

Action

Provides details about one of the following actions that affects or that was taken on a resource:

  • A remote IP address issued an AWS API call

  • A DNS request was received

  • A remote IP address attempted to connect to an EC2 instance

  • A remote IP address attempted a port probe on an EC2 instance

Contents

ActionType

The type of action that was detected. The possible action types are:

  • NETWORK_CONNECTION

  • AWS_API_CALL

  • DNS_REQUEST

  • PORT_PROBE

Type: String

Pattern: .*\S.*

Required: No

AwsApiCallAction

Included if ActionType is AWS_API_CALL. Provides details about the API call that was detected.

Type: AwsApiCallAction object

Required: No

DnsRequestAction

Included if ActionType is DNS_REQUEST. Provides details about the DNS request that was detected.

Type: DnsRequestAction object

Required: No

NetworkConnectionAction

Included if ActionType is NETWORK_CONNECTION. Provides details about the network connection that was detected.

Type: NetworkConnectionAction object

Required: No

PortProbeAction

Included if ActionType is PORT_PROBE. Provides details about the port probe that was detected.

Type: PortProbeAction object

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: